{
  "schema": "aaes/capability-pack/1",
  "provider": "anthropic",
  "version": "1.0.0",
  "description": "Anthropic organization administration through the Admin API: workspaces and workspace members, API key status, organization members, and usage and cost reports.",
  "notes": "Every endpoint is on api.anthropic.com under /v1/organizations. WORKSPACE_ID, USER_ID and API_KEY_ID are path placeholders to bind before enabling. Each request must carry the header anthropic-version: 2023-06-01, which every example in the Admin API documentation sends; it is a request header the caller supplies, not part of the credential, and moving to a newer version is a re-review trigger.\n\nTiers sit at the floor of the declared actions. Archiving a workspace is registered as delete because Anthropic documents it cannot be undone and that it archives the workspace's API keys. The API key update declares delete because the same call can set status archived, which is permanent. Removals are R3. Role changes are R2 by the action floor, and policy should raise them.\n\nThe Admin API cannot create API keys: Anthropic documents that keys are created in the Claude Console and the API can only read, rename and change the status of existing keys. Rotation is therefore a Console step followed by the registered status change that retires the old key.\n\nEvery other operation in the Admin API reference is excluded, among them the organization info endpoint, invites, workspace retrieval and update, single-member, single-key and single-user retrieval, workspace and organization rate limits (including the workspace rate-limit update), service accounts and their workspace bindings, workload identity federation issuers and rules, external keys (CMEK), compliance settings, Claude Code analytics, and the Enterprise-only groups, roles, spend limits and plugins endpoints. AAES has not been certified by Anthropic; these endpoints are configuration to review and test.",
  "credential": {
    "secret_ref_id": "secret-ref-anthropic-admin-key",
    "custody": "customer_vault",
    "inject": "header",
    "inject_name": "x-api-key",
    "note": "An Anthropic Admin API key held in the client's own secret manager, injected as the x-api-key header. The stored material is the key itself, with no scheme. Only organization members with the admin role can create an Admin API key, in the Claude Console. The Admin API also accepts an OAuth token with the org:admin scope; this pack registers the Admin API key only. Rotate by creating a new key in the Console, storing it under this reference, then retiring the old one. The executor injects the stored value unchanged and performs no key lifecycle.\n\nThe value must live only in executor memory for a call and never in logs, traces, diagnostics or crash dumps; a deployment that cannot meet that bar must not enable the pack."
  },
  "capabilities": [
    {
      "capability_id": "anthropic.workspaces.list",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces",
      "method": "GET",
      "connector": "http",
      "actions": [
        "read"
      ],
      "resource_id": "anthropic-organization",
      "description": "List the organization's workspaces with name, data residency, tags and archived time. Archived workspaces and the Default Workspace are left out unless include_archived or include_default is set.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.workspace.create",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces",
      "method": "POST",
      "connector": "http",
      "actions": [
        "create"
      ],
      "resource_id": "anthropic-organization",
      "description": "Create a workspace. The body takes a name and optional data residency, display color, tags and a customer-managed key id; Anthropic documents that the key id cannot be detached or replaced once set.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.workspace.archive",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces/WORKSPACE_ID/archive",
      "method": "POST",
      "connector": "http",
      "actions": [
        "delete"
      ],
      "resource_id": "anthropic-organization",
      "description": "Archive a workspace. Anthropic documents that archiving deactivates the workspace, archives every API key created for it within seconds, and cannot be undone, so the capability declares delete at R3. WORKSPACE_ID is a placeholder.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.workspace.members.list",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces/WORKSPACE_ID/members",
      "method": "GET",
      "connector": "http",
      "actions": [
        "read"
      ],
      "resource_id": "anthropic-organization",
      "description": "List a workspace's members by user id with their workspace roles. WORKSPACE_ID is a placeholder.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.workspace.member.add",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces/WORKSPACE_ID/members",
      "method": "POST",
      "connector": "http",
      "actions": [
        "create"
      ],
      "resource_id": "anthropic-organization",
      "description": "Add an organization member to a workspace with a workspace role. WORKSPACE_ID is a placeholder.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.workspace.member.update",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces/WORKSPACE_ID/members/USER_ID",
      "method": "POST",
      "connector": "http",
      "actions": [
        "update"
      ],
      "resource_id": "anthropic-organization",
      "description": "Change a member's workspace role. WORKSPACE_ID and USER_ID are placeholders.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.workspace.member.remove",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/workspaces/WORKSPACE_ID/members/USER_ID",
      "method": "DELETE",
      "connector": "http",
      "actions": [
        "delete"
      ],
      "resource_id": "anthropic-organization",
      "description": "Remove a member from a workspace. A single-workspace key that member holds stops working there. WORKSPACE_ID and USER_ID are placeholders.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.api-keys.list",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/api_keys",
      "method": "GET",
      "connector": "http",
      "actions": [
        "read"
      ],
      "resource_id": "anthropic-organization",
      "description": "List the organization's API keys with name, status, partial key hint, expiry, scope and the principal each acts as, optionally filtered by workspace, status or creator.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.api-key.update",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/api_keys/API_KEY_ID",
      "method": "POST",
      "connector": "http",
      "actions": [
        "update",
        "delete"
      ],
      "resource_id": "anthropic-organization",
      "description": "Rename an API key or change its status to active, inactive or archived. Anthropic documents inactive as reversible and archived as permanent; one endpoint takes both, so the capability declares delete at R3. API_KEY_ID is a placeholder.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.users.list",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/users",
      "method": "GET",
      "connector": "http",
      "actions": [
        "read"
      ],
      "resource_id": "anthropic-organization",
      "description": "List the organization's members with email addresses, names and roles, optionally filtered by email.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.user.update",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R2",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/users/USER_ID",
      "method": "POST",
      "connector": "http",
      "actions": [
        "update"
      ],
      "resource_id": "anthropic-organization",
      "description": "Change a member's organization role. The admin role cannot be assigned through the API. USER_ID is a placeholder.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.user.remove",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R3",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "pii",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/users/USER_ID",
      "method": "DELETE",
      "connector": "http",
      "actions": [
        "delete"
      ],
      "resource_id": "anthropic-organization",
      "description": "Remove a member from the organization. Anthropic documents that the member's personal keys are archived and are not restored on re-invitation. Admins cannot be removed through the API. USER_ID is a placeholder.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.usage-report.messages.get",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "internal",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/usage_report/messages",
      "method": "GET",
      "connector": "http",
      "actions": [
        "read"
      ],
      "resource_id": "anthropic-organization",
      "description": "Read token usage for the Messages API in time buckets, optionally grouped or filtered by model, workspace, API key and service tier.",
      "requires_review": true
    },
    {
      "capability_id": "anthropic.cost-report.get",
      "version": "1.0.0",
      "kind": "tool",
      "risk_tier": "R0",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN",
      "data_class": "financial",
      "egress_allowlist": [
        "api.anthropic.com"
      ],
      "endpoint": "https://api.anthropic.com/v1/organizations/cost_report",
      "method": "GET",
      "connector": "http",
      "actions": [
        "read"
      ],
      "resource_id": "anthropic-organization-costs",
      "description": "Read the organization's cost breakdown in USD, optionally grouped by workspace and description. This is spend data, registered at the read floor.",
      "requires_review": true
    }
  ],
  "resources": [
    {
      "resource_id": "anthropic-organization",
      "kind": "api",
      "locator": "https://api.anthropic.com/v1/organizations",
      "data_class": "pii",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    },
    {
      "resource_id": "anthropic-organization-costs",
      "kind": "api",
      "locator": "https://api.anthropic.com/v1/organizations/cost_report",
      "data_class": "financial",
      "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN"
    }
  ],
  "review": {
    "state": "library",
    "date": "2026-10-22",
    "sources": [
      "https://platform.claude.com/docs/en/api/administration-api (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/manage-claude/authentication (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/manage-claude/workspaces (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/manage-claude/usage-cost-api (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/list (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/create (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/archive (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/members/list (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/members/add (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/members/update (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/workspaces/members/remove (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/api_keys/list (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/api_keys/update (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/users/list (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/users/update (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/organization/users/remove (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/beta/organization/usage_report/retrieve_messages (retrieved 2026-10-22)",
      "https://platform.claude.com/docs/en/api/beta/organization/cost_report/retrieve (retrieved 2026-10-22)"
    ],
    "reviewer_id": "owner-delegated"
  }
}